İzlenen etki alanlarını arayın ve kaydedilmiş kanıtları, tespitleri ve en son gözlemlenen erişilebilirlik durumunu inceleyin.

192,599

Toplam Takip Edilen

VT Algılandı

85,994

En Son Görüldü: Aktif

108,606

Son kontrolde erişilemiyordu

VT Beklemede

KRİTİK THREAT

Fake AML Kimlik Doğrulama Dolandırıcılığı: How Scammers Impersonate Compliance Araçlar

PhishDestroy currently associates 2,022 tracked domain reports with Fake AML Kontrol et Scam. Review stored detections, evidence, and the latest observed availability below.

2,022

Alan adları Detected

KRİTİK

Threat Level

How This Attack Works

The scam exploits growing awareness of AML/KYC compliance requirements in crypto. Users who want to verify their funds are "clean" land on a convincing clone and unknowingly authorize a wallet drainer.

STEP 1

Lure via Search & Social

Victims encounter fake AML check sites through Google Ads, Telegram DMs, social media posts, or SEO-poisoned search results for queries like "check wallet AML" or "is my crypto clean."

STEP 2

Clone Legitimate UI

The site closely mimics the official AMLBot.com design, branding, and interface. Some clones replicate staff profiles and create fake Telegram accounts impersonating AMLBot team members.

STEP 3

Request Wallet Connection

Unlike the real AMLBot (which only needs a wallet address as text input), the fake site asks users to "connect wallet" via MetaMask or WalletConnect to "generate an AML report."

STEP 4

Drain Assets via Smart Contract

The wallet connection triggers a malicious smart contract (setApprovalForAll or token approval) that scans all tokens/NFTs, prioritizes highest-value assets, and drains everything to attacker-controlled wallets. Transactions are irreversible.

Technical Analysis

The AML scam ecosystem uses sophisticated infrastructure. Alan adları typically use .com, .org, .app TLDs registered through privacy-friendly registrars (NICENIC, WEBCC account for 163+ domains). Many use Cloudflare CDN for legitimacy.

The drainer mechanism is identical to other wallet-connect phishing: upon connection, the site calls setApprovalForAll() or increaseAllowance() on the victim's token contracts. The drainer scans all assets, estimates value, and prioritizes extraction of highest-value tokens first.

According to AMLBot's 2025 Crypto Crime Rapor, 65% of crypto incidents are driven by social engineering rather than technical exploits, with phishing ranking as the #2 attack type (18% of all incidents).

Key technical indicators: domains containing 'aml', 'amlbot', 'aml-check', 'aml-verify' in the URL; wallet connection prompts (the real AMLBot never requires this); recently registered domains; missing or fake SSL certificates.

Real Cases

AMLBot Clone Wave (2024-2026) (2024-2026)

1,350+ fake domains stolen

AMLBot officially warned about an alarming rise in scammers impersonating AMLBot on various platforms, including fake Telegram bots and clone websites.

amlcheckwallet.cc Drainer (2024)

Wallet drainer active stolen

Registered via Dynadot Inc, resolved to Cloudflare IP 104.21.25.10. Served a fake "AML wallet check" interface with wallet-connect drainer. PhishDestroy report.

PCRisk AML Warning (Jan 2026) (January 2026)

12+ documented domains stolen

PCRisk documented a new wave of fake AMLBot sites including amlbotchecks.com, aml-safety.app, amlrobotsaveru.com, amlpremium.top. FTC reports over 46,000 people lost $1 billion to crypto scams since 2021. PCRisk report.

amlbotchecking.com Campaign (2024)

Multiple victims stolen

Typosquat of AMLBot serving crypto drainer via fake compliance check UI. Documented by Malware Guide and PCRisk.

How to Detect

Site asks to "connect wallet" — the real AMLBot only needs a wallet ADDRESS as text input, never a wallet connection

Etki Alanı contains "aml" variations: amlbot, aml-check, aml-verify, amlcrypto (verify against official amlbot.com)

Recently registered domain (check WHOIS — legitimate AML services have years of history)

Acil messaging: "Your wallet may be flagged" or "Kontrol et compliance before funds are frozen"

Promoted via Telegram DMs, Google Ads, or unsolicited emails instead of organic search

How to Protect Yourself

1 Bookmark the official AMLBot at amlbot.com — never click links from ads, DMs, or emails

2 Remember: legitimate AML tools only need a wallet address (text), never a wallet connection or private keys

3 Kontrol et any AML domain on PhishDestroy before interacting with it

4 Use a separate "burner" wallet with minimal funds when testing any new DeFi/Web3 service

5 If you connected your wallet to a suspicious site: immediately transfer remaining funds to a NEW wallet and revoke approvals at revoke.cash

Frequently Asked Questions

What is a Fake AML Kontrol et Scam?

It's a phishing attack where fake websites impersonate legitimate AML compliance tools like AMLBot.com. They trick users into connecting their crypto wallets for a fake "compliance check," which actually triggers a smart contract that drains all assets. The real AMLBot only needs a wallet address typed as text — it never asks for wallet connections.

How many fake AML domains has PhishDestroy detected?

PhishDestroy currently tracks over 1,054 domains related to AML scams, including typosquats of AMLBot, generic fake AML checkers, and sites using "aml-verify" or "aml-check" in their names. The number grows daily as scammers register new domains.

How do I check if an AML site is legitimate?

The only official AMLBot website is amlbot.com. Any other domain claiming to be AMLBot is a scam. You can verify any domain at PhishDestroy.io. Red flags: wallet connection requests, recently registered domain, promotion via Telegram DMs or ads.

What should I do if I connected my wallet to a fake AML site?

Act immediately: 1) Transfer ALL remaining funds to a brand new wallet, 2) Jeton onaylarını iptal et using revoke.cash, 3) Rapor to authorities (FTC, FBI IC3), 4) Document everything (transaction hashes, screenshots, URLs). Never pay anyone claiming they can "recover" your funds.

Data sourced from PhishDestroy threat intelligence database — 2,022 domains tracked for this threat type

Fake AML Kontrol et Scam 2,022 domains

security-indexer--adamlee160686.replit.app

23 VTBilinmiyorGoogle

security-indexer--adamlee160686.replit.app

instagramlogin68.blogspot.com

22 VTEtkingoogle

instagramlogin68.blogspot.com

chamlang.ekklesiadallas.info

21 VTEtkinallegro

instagramloginverify.blogspot.com

21 VTBilinmiyorInstagram

instagramloginverify.blogspot.com

cnsqarrlognn.webflow.io

20 VTBilinmiyorcoinsquare

cnsqarrlognn.webflow.io

itrstcptllogin.webflow.io

20 VTBilinmiyor

itrstcptllogin.webflow.io

karmanakamloggen.godaddysites.com

20 VTBilinmiyorKraken

karmanakamloggen.godaddysites.com

nxjohny-user-coinbaseaml-blurtrench.pages.dev

20 VTBilinmiyorWallet Connect AbuseCoinbase

nxjohny-user-coinbaseaml-blurtrench.pages.dev

trust-aml.org

20 VTEtkingenericcrypto

amldetectionservices.com

19 VTEtkingenericcrypto

amldetectionservices.com

cleancoin.lol

19 VTEtkincsgo

cleancoin.lol

instagramloginpassword.blogspot.com

19 VTEtkinfacebook

instagramloginpassword.blogspot.com

metamask-extension-get.created.app

19 VTBilinmiyorMetaMask

metamask-extension-get.created.app

trust-wallet-aml.org

19 VTBilinmiyorTrustWallet

blekfilogvn.webflow.io

18 VTEtkingenericcrypto

blekfilogxn.webflow.io

18 VTEtkingenericcrypto

blekfilogxn.webflow.io

18 VTBilinmiyorbitget

coinsecurityscan.com

complienceaml.help

18 VTBilinmiyoracross

18 VTBilinmiyorAMLBot

ethercheck.app

exodus-webs-wellet-en.pages.dev

18 VTBilinmiyorethereum

exodus-webs-wellet-en.pages.dev

kkrakkennllogain.webflow.io

18 VTBilinmiyorKraken

kkrakkennllogain.webflow.io

mitomask-wallety.webflow.io

18 VTBilinmiyorMetaMask

mitomask-wallety.webflow.io

18 VTBilinmiyoracross

17 VTBilinmiyorgenericcrypto

17 VTBilinmiyoracross

17 VTBilinmiyorgenericcrypto

amlservicebot.com

analytics-aml.com

17 VTBilinmiyorAMLBot

analytics-aml.com

auditex.app

17 VTBilinmiyoracross

17 VTBilinmiyorWallet Connect Abusecsgo

claim-momentum.com

download.web-metamask.to

17 VTEtkinMetaMask

download.web-metamask.to

instagramlogin-eta.vercel.app

17 VTBilinmiyor

instagramlogin-eta.vercel.app

instagramlogin99.blogspot.com

17 VTEtkinInstagram

instagramlogin99.blogspot.com

kouiikoxulogin.webflow.io

17 VTBilinmiyorgenericcrypto

kouiikoxulogin.webflow.io

kucoilnlogiin.webflow.io

17 VTEtkinKuCoin

kucoilnlogiin.webflow.io

kucoinlogin-web.webflow.io

17 VTBilinmiyorKuCoin

kucoinlogin-web.webflow.io

kucoinlogingty.webflow.io

17 VTBilinmiyorKuCoin

kucoinlogingty.webflow.io

raydiumsol.com

17 VTEtkinRaydium

raydiumsol.com

secure-transaction.sbs

17 VTBilinmiyorbinance

secure-transaction.sbs

tetheraudit-bot.com

17 VTBilinmiyorpolygon

tetheraudit-bot.com

thesaferelemento.net

17 VTEtkingenericcrypto

thesaferelemento.net

trezor-bridge-info.live

17 VTBilinmiyorTrezor

trezor-bridge-info.live

17 VTEtkinTrust Wallet

trustwalletaml.com

twalletaudit.com.invite-web3-copytrading.app

17 VTEtkingenericcrypto

twalletaudit.com.invite-web3-copytrading.app

web-chrome-extension-coinbase.typedream.app

17 VTBilinmiyorCoinbase

web-chrome-extension-coinbase.typedream.app

www.automatedkycservices.com

17 VTEtkingenericcrypto

www.automatedkycservices.com

xz12312333.elysium-drainer.world

17 VTBilinmiyorWallet Connect Abusecsgo

xz12312333.elysium-drainer.world

16 VTEtkinTrust Wallet

aml-trust.app

aml-trust.info

16 VTEtkinWallet Connect Abusecsgo

16 VTBilinmiyorgenericcrypto

amlchec.pro

amlchecked.net

16 VTBilinmiyorgenericcrypto

16 VTBilinmiyorgenericcrypto

amlconfirm.site

amldetectionservices.us

16 VTBilinmiyorMetaMask

16 VTEtkingenericcrypto

amlultra.com

16 VTEtkingenericcrypto

blekfilogon.webflow.io

16 VTBilinmiyorBlockFi

blekfilogon.webflow.io

16 VTBilinmiyorCrypto.com

checkscrypto.com

eth-crypto-exchange.com

16 VTEtkinaave

eth-crypto-exchange.com

16 VTBilinmiyorgenericcrypto

fraud-check.help

helpz-blckfip.webflow.io

16 VTEtkin

1 2 3 4 Sonraki » Sayfa 1 ...'nin 21

Tehdit Müdahale Pipeline

Bu merkezde yer alan her bir alan adının nasıl doğrulandığı ve teyit edilmiş tehditlerin nasıl etkisiz hale getirildiği. Boru hattının tam görselleştirilmesi →

Tehdit İstihbaratı Kontroller— her alan adı taranır ve aşağıdakilerle karşılaştırılarak kontrol edilir: